Audit warning messages shown in the status report after installation

I think we need to deal with these separately.

I created 📌 Resolve warning about SVG media type not using image styles Active for the SVG warning and two other issues are linked in the IS already. I guess Navigation won't be marked stable before v1, in which case we could suppress it in Gin.

The only other one is:

Configuration files
Protection disabled. The file sites/default/settings.php is not protected from modifications and poses a security risk. You must change the file's permissions to be non-writable.

But this is by design in DDEV that these are writeable. I'm not super worried about this warning appearing for DDEV (or other local tool) users since there's some assumed awareness. I did create 📌 Update warning about write permissions Active for a different warning about this in core on install. But I don't think Drupal CMS can/should remove this warning since it is something the user should be aware of? If it were to appear in the (future) browser-based trial experience, that would be a problem. But for local dev, I think it's OK?

Thanks for creating the issues!

But I don't think Drupal CMS can/should remove this warning since it is something the user should be aware of? If it were to appear in the (future) browser-based trial experience, that would be a problem. But for local dev, I think it's OK?

Agree, but I saw the warning when installed the RC1 from zip archive. Is that still considered as a dev version?

The zip archive comes configured to use DDEV. It's not a "dev version", but it is for local development. DDEV specifically sets $settings['skip_permissions_hardening'] = TRUE; in settings.ddev.php. If you are working locally using something else, it would depend on how that is set up, but if it doesn't have this then you wouldn't see the warning.

So just to confirm, if we remove that folder in 🐛 Remove .ddev directory from composer create-project Active , then in the Drupal CMS 1.0.0 zip file the warning will not be present? If so, I think then it is OK. Thanks!

No. If you are using DDEV for local development, you will see the warning, unless you override your local settings to remove $settings['skip_permissions_hardening'] = TRUE;

Installed the rc1 without ddev and the message is not there, so I suppose this should be ok :) Thanks.

Regarding the Navigation module and info about the fact that it is still experimental - could we at least mention this on 1.0.0 release notes with a link to the docs page here ( https://www.drupal.org/about/core/policies/core-change-policies/experime... → ), so that users are aware, that the module is covered by security advisory policy and should be safe to use? Do we need an issue for this?

Then I think we can close this, as we have other messages covered.

Thanks for confirming.

Adding it to the release notes is one option, I created 📌 Handle comms around Navigation being experimental Active to address this.